Generally, security systems employ an identity-based authentication scheme to verify the identity of an entity before granting access to a computer system or a computerized resource. One goal of such security systems is to accurately determine identity so that an unauthorized party cannot gain access. Security systems can use one or more of several factors, alone or in combination, to authenticate entities. For example, identification systems can be based on something that the entity knows, something the entity is, or something that the entity has.
Examples of something an entity knows are a code word, password, personal identification number (“PIN”) and the like. One exemplary computer-based authentication method involves the communication of a secret that is specific to a particular entity or user. The entity seeking authentication transmits the secret or a value derived from the secret to a verifier, which authenticates the identity of the entity. In a typical implementation, an entity communicates both identifying information (e.g., a user name) and a secret (e.g., a password) to the verifier. The verifier typically possesses records that associate a secret with each entity. If the verifier receives the appropriate secret for the entity, the entity is successfully authenticated. If the verifier does not receive the correct secret, the authentication fails.
Examples of something the entity is include a distinct characteristic or attribute known as a biometric. It will be known by those skilled in the art that a biometric is a unique physical or behavioral characteristic or attribute that can be used to identify a person uniquely. Biometrics encompass a variety of techniques designed to accurately identify a person including fingerprinting, facial recognition, retina blood vessel patterns, DNA sequences, voice and body movement recognition, handwriting and signature recognition. Examples of advances in biometric technology include devices such as a biometric mouse that can offer a fingerprint reader and the capacity for collection of specific user clickstream data for statistical analysis. It will appreciated that suitable physical or behavioral characteristics or attributes are typically not under the control of the person, and are therefore difficult for anyone besides the intended person to present, because, in part, they are difficult to replicate. The verifier typically can observe these physical or behavioral characteristics or attributes and compare these to records that associate the characteristics or attributes with the entity. The observation of these characteristics or attributes is referred to generally as biometric measurement.
An example of something an entity possesses is a physical or digital object, referred to generally as a token, that is unique, or relatively unique, to the user. It will be appreciated that possession of a token such as a bank card having certain specific physical and electronic characteristics, for example containing a specific identification number that is revealed when the token is accessed in a particular manner, can be this type of factor. A token containing a computing device that performs encryption using an encryption key contained in the device would also be regarded as this type of factor. For example, a token could accept user input, which might include a PIN or a challenge value, and provide as output a result encrypted with a secret encryption key stored in the card. The verifier can then compare the output to an expected value in order to authenticate the entity.
However, if an entity is successful in authenticating their identity by virtue of what the entity knows, something the entity is, or something that the entity has, the security access to the computer system or computerized resource may be granted for an unlimited time period. This is undesirable.